Security audit
Jtexpress
Security checks across malware telemetry and agentic risk
Overview
This is a documentation-only J&T Express helper skill with disclosed, purpose-aligned guidance and no executable code in the reviewed package.
Install is reasonable if you want a J&T Express shipping assistant. If you use any local runtime features, expect possible local history, subscription, address, encrypted helper, and privacy export files under ~/.openclaw/data/jtexpress/, and use the documented privacy clear/export/info controls when needed.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.